OpenCode warns users to rotate provider keys after legacy-system intrusion
A customer notice says keys saved in OpenCode workspaces may have been exposed; the warning puts cloud-held credentials at the center of the incident.
By Ryan Merket · Published · Updated
Primary source: X
Why it matters
AI coding agents can sit between a developer's projects and paid model APIs. When a service stores provider keys for workspace convenience, a compromise can turn into both a security incident and an unexpected bill; the circulated 1.4% figure does not by itself measure either exposure or loss.
OpenCode told some customers to revoke and replace third-party API keys after unauthorized access to a legacy system may have exposed credentials saved in their workspaces. Security professional Matt Johansen (@mattjay) amplified the warning on October 17th, saying OpenCode users were being told to rotate keys. The notice, reproduced in the X thread, names OpenAI and Anthropic keys as examples and asks recipients to check provider usage for unexpected activity.…